0

On a machine I (tlous) have been given access to open a shell as another user (serviceAccount)

Executing: sudo su - serviceAccount has the desired effect of opening a shell as this serviceAccount user. So far so good.

This is nice, but I want to run a command as this user without opening a shell.

Let's say the command is whoami

I've tried:

sudo -u serviceAccount whoami

Sorry, user tlous is not allowed to execute '/usr/bin/whoami' as serviceAccount ...

sudo su - serviceAccount -c whoami

Sorry, user tlous is not allowed to execute '/bin/su - serviceAccount -c whoami' ...

And other variations. What am I missing? Can this be done in a oneliner? The reason is that I actually want to run this as an ssh command: ssh -t tlous@server.example.com sudo su - serviceAccount -c whoami

Update 20190412 with sudo -l

sudo -l

Matching Defaults entries for tlous on this host:
    !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY
    LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, !authenticate

User tlous may run the following commands on this host:
    (root) /usr/bin/su - serviceAccount, /bin/su - serviceAccount
  • 2
    Add the output of sudo -l to the question, please. – muru Apr 12 at 12:59
0

Based on your output from sudo -l, to wit:

User tlous may run the following commands on this host:
    (root) /usr/bin/su - serviceAccount, /bin/su - serviceAccount

You are given explicit rights in the sudoers configuration to run two specific commands:

  • /usr/bin/su - serviceAccount
  • /bin/su - serviceAccount

Adding more parameters, as you're trying (e. g. sudo -u serviceAccount whoami) is not on the approved command list.

You will need to request that your system administrator add to the sudoers configuration the other commands you desire access to run via sudo.

-1

Maybe you can try this:

ssh -t tlous@server.example.com "sudo -u serviceAccount whoami"

  • Already tried that (see first below I've tried) – Tom Lous Apr 12 at 13:02
  • Edit sudoers file and allow user serviceAccount to execute that command – Igor Smitran Apr 12 at 13:13
  • If I could do that I wouldn't have this issue in the first place :-) – Tom Lous Apr 12 at 13:14
  • Maybe you can try this instead: ssh -t tlous@server.example.com "sudo su -c whoami serviceAccount" – Igor Smitran Apr 12 at 13:20
  • I have tried what you are trying on my VM and it seems to work fine. What OS are you on? – Atul Apr 12 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.